Medium severity · published Feb 9, 2022
CVE-2022-22567
Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability
5.1
CVSS
0.1%
EPSS
No
On KEV
Description
Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Alienware Area 51m R1 Firmware · Dell
before 1.16.0 · source: NVD
AA
Alienware Area 51m R2 Firmware · Dell
before 1.11.0 · source: NVD
AM
Alienware M15 R3 Firmware · Dell
before 1.12.0 · source: NVD
AM
Alienware M15 R4 Firmware · Dell
before 1.6.2 · source: NVD
AM
Alienware M15 R6 Firmware · Dell
before 1.6.0; after 1.6.0 before 1.8.0 · source: NVD
AM
Alienware M17 R3 Firmware · Dell
before 1.12.0 · source: NVD
AM
Alienware M17 R4 Firmware · Dell
before 1.6.2 · source: NVD
C3
Chengming 3990 Firmware · Dell
before 1.6.0 · source: NVD
C3
Chengming 3991 Firmware · Dell
before 1.6.0 · source: NVD
G5
G15 5510 Firmware · Dell
before 1.8.0 · source: NVD
G5
G15 5511 Firmware · Dell
before 1.9.0 · source: NVD
G3
G3 3500 Firmware · Dell
before 1.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22567
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028
More from Alienware Area 51m R1 Firmware
7.8
CVE-2022-32493
Dell BIOS contains an Stack-Based Buffer Overflow vulnerability
7.8
CVE-2022-32491
Dell Client BIOS contains a Buffer Overflow vulnerability
7.8
CVE-2022-32489
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32488
Dell BIOS contains an improper input validation vulnerability
7.8
CVE-2022-32487
Dell BIOS contains an improper input validation vulnerability